@bongos/core 1.21.157 → 1.21.158

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.157",
-  "core_contract": "1.21.157",
-  "source_commit": "93bcf1aad3e309875901549d239f182802ecb1a5",
+  "core_version": "1.21.158",
+  "core_contract": "1.21.158",
+  "source_commit": "3489a15a31499506f0eff7e906cfda2d98431e90",
   "source_ref": "HEAD",
-  "built_at": "2026-10-22T22:00:48.501Z",
+  "built_at": "2026-10-22T22:19:00.152Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3810,
-  "tree_sha256": "7208fdbac3ca1ecbfc01170ccff02b76309f064b711c6b28b8a7e97bfc452af4",
+  "tree_sha256": "3b096c21388e06866acbe8324be4412fd05377ff38878dafe62e112c722447b0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -337,7 +337,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "da5faaa41094a05ac71f09706bae462a5507e7bea5b6faa1ac3963dbe47f3426"
+      "sha256": "71db0ddcc4d2ca7d06c2aceabcd9b231b2a27820a8907693f3729712fd628444"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2387,7 +2387,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "1545ce6f2f92ca70568121874934ee58a84cbf46c4c93352566b3dc4c92a91d0"
+      "sha256": "4e52703b8cda179fb90c9ab0dfee088ad7b76761af74e112a1de7f8887f5e3f2"
     },
     {
       "path": "docs/architecture.md",
@@ -2927,12 +2927,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "121987b73841075c24382367357b7cab66e45b8d46954442d3ea0f8104bef1ee"
+      "sha256": "6fad8de7a3054c6e7b8b332031be0c18ed8f46c2af96f4239e4a4ccec33ba99d"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "fe1926592aa0572fdcb7fc0352f217762a54292bf8727825d75e2f6799020c13"
+      "sha256": "e8063afec0e26bb9b745fa18e1856f8a26e7ef0f3e4e9f31677efb623fb58ac0"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -10557,12 +10557,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "46bee705e46ddb6956d2cf4309854febf36c941657839b8f90a2497fee8ebad0"
+      "sha256": "43aaf784a6ee3ebf4f84cc98e112f8997a5203aa14a07af4dfbedcc095095b84"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3f0a9053c50d3b2e53a7e407db5723204dab8ed240b2d286b264afc063ccf215"
+      "sha256": "2dd1e6902491a012efb456d02ebe5b3fd8d1d45cd5f85780a2e068b465a73911"
     },
     {
       "path": "public-docs/index.html",
@@ -10582,7 +10582,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "70d9278d1e69d83e275f178ecd83f2c99dd3639a780851eeb3428063280ac326"
+      "sha256": "8081f6270f14a4a734dbd8b65c3eab717e38a0a7089c14f3b21405bb734639e5"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11512,7 +11512,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "075fa6d5a5100ec600498113f1f8119015ce713eaf9b104cd288d11cd10e73d7"
+      "sha256": "7277f499a707f7c946ee8aec839f4f13539b8178ef9915f6c5d623acb341c9ae"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -12712,7 +12712,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "c45fffd2d1320cfadd2177421e8b58643676a71fa1bac7a01e4219c60bfe20b1"
+      "sha256": "fb6fdff53de296e7b8d981082013d57f65f1e89ae234a7d417e6e455578b94a3"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -12877,7 +12877,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "32629fb4c71f974770e9f8e11f2ea9daf9a951520acd00857077e74b201e7126"
+      "sha256": "a3d9bfef9fdb4a1b8c1050555eaeafc80d312963368eaab6838cf56089c02578"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
@@ -12967,7 +12967,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0f74f86dd0e2c80f385d02a49a6713d34aea8f56af8685b1ee92cc9083d79f44"
+      "sha256": "eba81df2b570c255f36f7ed29ac55ff488f1aad92984d9c38fe2d4842c047cef"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16652,7 +16652,7 @@
     {
       "path": "tests/module_store_publish.mjs",
       "mode": "0000644",
-      "sha256": "6392bc2e1554cdef18145a0598f4d7fc22305c0744e864c0f2526848609fd13a"
+      "sha256": "1ef4980d9afca0dd5bbf2af174098144eac20d62bec52ab642cf314a5d7889d1"
     },
     {
       "path": "tests/module_store_publish_route.mjs",

package/clients/bongos-client/index.d.ts

@@ -548,7 +548,7 @@ export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
 export interface PostStoreModulesKeyDelistRequest { reason?: string }
 export interface PostStoreModulesKeyDelistResponse { ok: boolean; module_key: unknown; status: unknown; delisted_at: unknown }
-export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
+export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown; channel: unknown }
 export interface PostStoreModulesKeyVersionsVersionErrorCountRequest { day: string; count: number }
 export interface PostStoreModulesKeyVersionsVersionInstallReportRequest { ok: boolean; error_code?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }

package/docs/api/openapi.json

@@ -23443,7 +23443,7 @@
           "store"
         ],
         "summary": "POST /store/modules/:key/versions",
-        "description": "POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). Body: the gzip tarball `bongos module publish` builds (scripts/gds/module-artifact.js), sent as application/gzip. The route trusts nothing but the bytes: it recomputes every hash, re-runs the publish denylist, validates module.json and checks that HOWTO.md has its required sections (ADR 0347 D4) itself (verifyModuleArtifact), then keeps the tarball on the control plane's disk and INSERTs the version row in one transaction (module-store.js). A key's first publish makes the caller its author; after that only the author may publish, a delisted key takes nothing new, and a version is published once and never changed. rank: metic+archon — it puts code in a shared store other instances install from. Gate: requirePermission('module.submit') — the atom that already guards filing a module into a shared queue; a dedicated `module.publish` atom is a follow-up once who-may-sell is decided.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
+        "description": "POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). Body: the gzip tarball `bongos module publish` builds (scripts/gds/module-artifact.js), sent as application/gzip. The route trusts nothing but the bytes: it recomputes every hash, re-runs the publish denylist, validates module.json and checks that HOWTO.md has its required sections (ADR 0347 D4) itself (verifyModuleArtifact), then keeps the tarball on the control plane's disk and INSERTs the version row in one transaction (module-store.js). A key's first publish makes the caller its author; after that only the author may publish, a delisted key takes nothing new, and a version is published once and never changed. Every new version lands on the tester channel; the body names no channel, so nothing here can skip testers (task 1003803, ADR 0344 D2). rank: metic+archon — it puts code in a shared store other instances install from. Gate: requirePermission('module.submit') — the atom that already guards filing a module into a shared queue; a dedicated `module.publish` atom is a follow-up once who-may-sell is decided.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/modules.js",
         "x-permissions": [
@@ -35052,12 +35052,14 @@
             "type": "boolean"
           },
           "created_module": {},
-          "version": {}
+          "version": {},
+          "channel": {}
         },
         "required": [
           "ok",
           "created_module",
-          "version"
+          "version",
+          "channel"
         ]
       },
       "PostStoreModulesKeyVersionsVersionErrorCountRequest": {

package/docs/module-api-changelog.md

@@ -3151,5 +3151,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.155 with no explicit bump. run 39808834444. (task 1002620)
   1.21.157 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.156 with no explicit bump. run 39861648960. (task 1002620)
+  1.21.158 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.157 with no explicit bump. run 39863960705. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -388,6 +388,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 
 - The version is `module.json`'s `version`. Each version is published **once** and must be newer than the last — bump it to publish a fix.
 - Your first publish of a key makes you its author; only the author can publish later versions, and a delisted key takes none.
+- **Every new version goes to testers first** (task 1003803, [ADR 0344](adr/0344-a-tester-is-a-project-that-opts-in-once.md) D2). A published version, first release or update, is recorded on the `tester` channel (`store_module_version_channels`, reason `new_version`), and the publish response says so as `channel`. A publish cannot name a channel, so there is no flag that sends an untested version to every project. Moving it to `general` is a separate, later step: the promotion gate (task 1003804).
 - The publish denylist applies (ADR 0098), plus a refusal of credential-named files (`.env*`, `*.pem`, `*.key`, `id_rsa`, …) anywhere in the module. The store re-checks every hash and the denylist itself.
 - Gate: Metic+ (`module.submit`) for now. This is not `bongos module submit`, which proposes a module *into* core.
 - **A how-to is required** ([ADR 0347](adr/0347-every-store-module-ships-a-how-to.md)). `modules/<key>/HOWTO.md` is what a buyer reads — the store shows it as the module's page — so it is written for the person who installs the module, not for an AI working inside it (that is `CLAUDE.md`). It is plain Markdown: any AI or person can write it. Publish refuses the version unless it has these five level-2 headings, in any order and any case, each with some text under it: `## What it does`, `## Install and enable`, `## How to use it` (with one worked example), `## Configuration` ("None." is fine) and `## Limits and known issues` ("None known." is fine). HTML comments don't count as text, so the scaffold's prompts must be replaced. The refusal names each failing section. The check is one function, `checkHowto` in `scripts/gds/module-artifact.js`; the CLI runs it before uploading and the store runs it again on upload, so a hand-built upload can't skip it. `bongos module check` reports it as advice only — an upstream submit is not gated by it. Install and update don't re-check it, so a version published before the gate still installs. The file travels in the tarball, so its hash pins it to the version. An optional `howto.artifactUrl` in `module.json` (an `https://` link on `claude.ai`) is shown as an extra, never graded.
@@ -405,7 +406,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - Install never enables. Switch the module on from the hall's Modules tab.
 - **Every version's how-to is a page** (task 1004366). `GET /store/modules/:key/versions/:version/howto` reads the `HOWTO.md` from that version's own stored tarball, after the same hash check install runs, and returns it as text; the hall shows it at `/builders/modules?howto=<key>&version=<X.Y.Z>`, rendered through the hall's escaping markdown reader (`md-reader.js`) because the file is author-written. Any signed-in builder can read it without holding the module; a delisted module's how-to reads only for people who hold it. "Save as PDF" is the browser's own print, with a print sheet that keeps only the document. The optional `howto.artifactUrl` shows as "Also available as a Claude page". Install prints the link, and a Modules-tab row links it when the module on disk is a published store version. A version published before the gate has none and answers 404 `howto_missing`.
 - A module already on disk, in the instance's `modules/` or bundled with the core, is refused; moving one to a newer version is `update`. A module this core cannot mount is refused before download.
-- A delisted module cannot be acquired or downloaded. Channels are not checked yet: every version is general until the channel tasks land.
+- A delisted module cannot be acquired or downloaded. Channels are not checked yet: install and update hand out a version whatever its channel until task 1003805 lands.
 
 `bongos module update <key> [--version X.Y.Z]` moves an installed store module forward through the same three calls, so a paid module and a free one take one identical path, and a module you already hold is never charged again (`tests/module_update.mjs` fails if a price-conditional branch appears).
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.157",
+  "version": "1.21.158",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.157",
+      "version": "1.21.158",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.157",
+  "version": "1.21.158",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9976,5 +9976,11 @@
       "id": "1003802",
       "text": "A project can now volunteer to try new versions of its modules before everyone else, and keep any single module on the normal versions."
     }
+  ],
+  "1.21.158": [
+    {
+      "id": "1003803",
+      "text": "When a module author publishes a new version, it now goes only to projects that volunteered to test, never straight to everyone."
+    }
   ]
 }

package/scripts/gds/module.js

@@ -1006,6 +1006,9 @@ async function cmdPublish(args, {
   }
   const row = res.data && res.data.version;
   log(`\n✓ Published "${key}" ${row ? row.version : sidecar.module_version} to the store${res.data && res.data.created_module ? ' — its first version, so you are its author' : ''}.`);
+  if (res.data && res.data.channel === 'tester') {
+    log('  It goes to testing projects first, and reaches every project once it has been tested (ADR 0344).');
+  }
   return 0;
 }
 

package/src/bongos/module-store.js

@@ -14,7 +14,8 @@
 //      the store_modules row on a key's first publish (the publisher becomes its
 //      author), refuse anyone else's key, refuse a delisted key (ADR 0338 D2: delisting
 //      stops what comes next), refuse a version that already exists or is not newer
-//      than the latest, then INSERT the version row. Rows are only ever INSERTed.
+//      than the latest, then INSERT the version row and put it on the tester
+//      channel (task 1003803, ADR 0344 D2). Rows are only ever INSERTed.
 //
 // If step 2 refuses, the route removes the temp file step 1 wrote, so a refused
 // publish leaves nothing behind.
@@ -164,8 +165,14 @@ function relativeArtifactPath(file, { dir = storeDir() } = {}) {
   return path.relative(dir, file).split(path.sep).join('/');
 }
 
+// Every new version, first release or update, starts on the tester channel (task
+// 1003803, ADR 0344 D2). It is not an input: a publish cannot name a channel, so no
+// omitted or mistyped flag can send an untested version to every project at once.
+// Reaching general is a separate, later act — the promotion gate (task 1003804).
+const PUBLISH_CHANNEL = 'tester';
+
 // One transaction. `db` is a pg Pool (anything with connect()). Returns
-// { ok: true, version: row, created: bool } or { ok: false, code, message, status }.
+// { ok: true, version: row, created: bool, channel } or { ok: false, code, message, status }.
 async function publishVersion(input, { db, beforeCommit } = {}) {
   const {
     key, title, description, version, coreVersion, manifest,
@@ -217,11 +224,16 @@ async function publishVersion(input, { db, beforeCommit } = {}) {
        RETURNING id, module_key, version, core_version, tree_sha256, tarball_sha256,
                  tarball_bytes, published_by, published_at`,
       [key, version, coreVersion, manifest, treeSha256, tarballSha256, bytes, relPath, builderId]);
+    // Same transaction as the version row, so no version is ever without a channel.
+    await client.query(
+      `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by)
+       VALUES ($1, $2, $3, $4)`,
+      [row.id, PUBLISH_CHANNEL, 'new_version', builderId]);
     // Put the tarball in place while the row is still uncommitted: if this throws,
     // the catch below rolls the row back, so the two can never disagree.
     if (beforeCommit) await beforeCommit();
     await client.query('COMMIT');
-    return { ok: true, created, version: row };
+    return { ok: true, created, version: row, channel: PUBLISH_CHANNEL };
   } catch (e) {
     try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
     // Two publishes of the same version racing past the check: the UNIQUE wins.

package/src/bongos/routes/modules.js

@@ -469,7 +469,8 @@ module.exports = function buildModulesRouter() {
   // in one transaction (module-store.js). A key's first
   // publish makes the caller its author; after that only the author may publish,
   // a delisted key takes nothing new, and a version is published once and never
-  // changed.
+  // changed. Every new version lands on the tester channel; the body names no
+  // channel, so nothing here can skip testers (task 1003803, ADR 0344 D2).
   //
   // rank: metic+archon — it puts code in a shared store other instances install
   // from. Gate: requirePermission('module.submit') — the atom that already guards
@@ -516,7 +517,7 @@ module.exports = function buildModulesRouter() {
       if (!result.ok) return res.fail(result.code, { status: result.status, message: result.message });
 
       console.log(`[gds] module "${key}" ${v.version} published to the store by builder ${req.builder.id}`);
-      res.status(201).json({ ok: true, created_module: result.created, version: result.version });
+      res.status(201).json({ ok: true, created_module: result.created, version: result.version, channel: result.channel });
       // A new version is a new thing to judge (task 1003794, ADR 0343): queue its
       // assessment after answering, since the Security gate asks npm about its
       // dependencies and can take a minute. The queue runs one at a time and is

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.157'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.158'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_store_publish.mjs

@@ -195,6 +195,7 @@ test('store: a key or version that could escape the store dir is refused before
 // A fake pg pool: `state` is the registry, answers are computed from it.
 function fakeDb(state = { modules: {}, versions: [] }) {
   const log = [];
+  state.channels = state.channels || [];
   const client = {
     async query(sql, params = []) {
       log.push(sql.trim().split(/\s+/).slice(0, 2).join(' '));
@@ -211,6 +212,10 @@ function fakeDb(state = { modules: {}, versions: [] }) {
         const row = { id: state.versions.length + 1, module_key: params[0], version: params[1] };
         state.versions.push(row); return { rows: [row] };
       }
+      if (/^INSERT INTO store_module_version_channels/.test(sql)) {
+        state.channels.push({ version_id: params[0], channel: params[1], reason: params[2], set_by: params[3] });
+        return { rows: [] };
+      }
       return { rows: [] };
     },
     release() {},
@@ -256,6 +261,33 @@ test('registry: a version is published once, and never older than the latest', a
   assert.equal(ok.ok, true, 'numeric, not string, ordering: 1.10.0 > 1.2.0');
 });
 
+// Task 1003803, ADR 0344 D2: every new version, first release or update, lands on
+// the tester channel. Publish takes no channel at all, so there is no flag to omit
+// or misspell; reaching everyone is the promotion gate's later act (task 1003804).
+test('channel: a first release lands on tester, recorded with who published it', async () => {
+  const db = fakeDb();
+  const r = await store.publishVersion(input(), { db: db.pool });
+  assert.equal(r.ok, true);
+  assert.equal(r.channel, 'tester');
+  assert.deepEqual(db.state.channels, [{ version_id: 1, channel: 'tester', reason: 'new_version', set_by: 7 }]);
+});
+
+test('channel: an update lands on tester too, never straight to general', async () => {
+  const state = { modules: { weather: { module_key: 'weather', author_id: 7, status: 'listed' } },
+    versions: [{ id: 1, module_key: 'weather', version: '1.1.0' }] };
+  const db = fakeDb(state);
+  const r = await store.publishVersion(input({ channel: 'general' }), { db: db.pool });
+  assert.equal(r.ok, true);
+  assert.equal(r.channel, 'tester', 'a channel named by the caller is not a way past testers');
+  assert.deepEqual(db.state.channels.map((c) => c.channel), ['tester']);
+});
+
+test('channel: a refused publish records no channel', async () => {
+  const db = fakeDb({ modules: { weather: { module_key: 'weather', author_id: 7, status: 'listed' } }, versions: [] });
+  await store.publishVersion(input({ builderId: 8 }), { db: db.pool });
+  assert.deepEqual(db.state.channels, []);
+});
+
 test('registry: if putting the file in place fails, the row is rolled back', async () => {
   const db = fakeDb();
   await assert.rejects(